Colombia Annex: Personal Data Transmission Contract

Colombia — ANX-CO: Personal Data Transmission Contract

Document ID: ANX-CO · Version: 1.0 · Effective date: [[TO CONFIRM: publication date]] Language: Spanish controls (es/annex-co.md: "Contrato de Transmisión de Datos Personales"). This English text is a convenience translation. Applies to: Clinics established in the Republic of Colombia. Part of the Master Data Processing Agreement (the "MDPA"). Terms defined in the MDPA have the same meaning here.

1. Nature and legal framework

1.1 A transmission contract. This Annex is the personal data transmission contract required by Article 25 of Decree 1377 of 2013, compiled in Article 2.2.2.25.5.2 of Decree 1074 of 2015 ("Decree 1377"). It is entered into between:

• the Clinic, as Responsable del Tratamiento (controller); and
• VstreamX, as Encargado del Tratamiento (processor),

under Statutory Law 1581 of 2012 ("Law 1581").

1.2 What the contract does. Under Article 26 of Decree 1377 (DUR 2.2.2.25.5.1), the transmission of personal data to an Encargado inside or outside Colombia does not require the data subject to be informed of it or to give consent, where this contract exists.

2. Scope of the processing

The processing covers the Clinic Data described in MDPA Schedule 1, including sensitive health data, of the data subjects listed there. It is limited to the provision of DentalX to the Clinic.

3. Activities the Encargado carries out on behalf of the Responsable

VstreamX carries out the following activities on the Clinic's behalf, and no others:

• hosting and storage;
• field encryption;
• organisation and retrieval;
• making the Service's features available to the Clinic's Users;
• sending emails and WhatsApp messages at the Clinic's instruction;
• AI-assisted drafting and reading at a User's request;
• backup and restoration;
• export, anonymisation and deletion at the Clinic's instruction; and
• support requested by the Clinic.

4. Undertakings of the Encargado

Through this contract, VstreamX undertakes to:

• (a) apply the obligations of the Clinic under the Clinic's personal-data processing policy (Política de Tratamiento), which the Clinic makes available to VstreamX on request. Where that policy requires something the Service cannot do, the Clinic will tell VstreamX, and the Parties will agree how to address it;
• (b) process the data in accordance with the purpose the data subjects authorised and the applicable laws;
• (c) process the data on behalf of the Clinic in accordance with the principles that protect it: legality, purpose, freedom, truthfulness or quality, transparency, restricted access and circulation, security and confidentiality (Law 1581, Art. 4);
• (d) safeguard the security of the databases containing the data (MDPA Schedule 2); and
• (e) keep confidentiality over the processing of the data (MDPA clause 5).

5. Duties of the Encargado under Article 18 of Law 1581

VstreamX, as Encargado:

• (a) guarantees to the data subject, at all times, the full and effective exercise of the right of habeas data, through the Clinic (clause 7);
• (b) keeps the information under the security conditions necessary to prevent its adulteration, loss, consultation, use or unauthorised or fraudulent access;
• (c) carries out the updating, rectification or suppression of the data in a timely manner. The Service lets the Clinic perform these itself;
• (d) updates the information reported by the Clinic within 5 business days of receiving it;
• (e) processes the queries and claims of data subjects in the terms of Law 1581, by forwarding them to the Clinic and assisting it (clause 7);
• (f) adopts an internal manual of policies and procedures to guarantee compliance with Law 1581, including for the attention of queries and claims [[TO CONFIRM: VstreamX's internal manual of personal-data policies for Colombia adopted before publication]];
• (g) records in the database the legend "claim in process" (reclamo en trámite), in the form the regulations set, where the Clinic so instructs;
• (h) inserts in the database the legend "information under judicial discussion" (información en discusión judicial) once notified by the competent authority of judicial proceedings concerning the quality of the data, where the Clinic so instructs;
• (i) refrains from circulating information that is being disputed by the data subject and whose blocking has been ordered by the Superintendence of Industry and Commerce ("SIC");
• (j) allows access to the information only to the persons who may have access to it;
• (k) informs the SIC when there are violations of the security codes and there are risks in the administration of the data subjects' information. VstreamX also notifies the Clinic as clause 8 provides; and
• (l) complies with the instructions and requirements the SIC issues.

6. International destinations

6.1 The transmission. The Clinic Data is transmitted to:

• Canada (VstreamX); and
• the United States and other countries where the Sub-processors operate (MDPA Schedule 3).

6.2 Recognised destinations. The United States and Canada are among the destinations that the SIC recognises as having an adequate level of protection: the United States by name, and Canada as a country declared adequate by the European Commission (External Circular 005 of 2017, numeral 3.2, as amended). In any case, the transmission is made under this contract.

7. Data subject requests

7.1 Assistance. VstreamX assists the Clinic within 5 business days, as MDPA clause 8 provides. This allows the Clinic to answer:

• queries (consultas) within 10 business days (Law 1581, Art. 14); and
• claims (reclamos) within 15 business days (Art. 15).

7.2 Requests received by VstreamX. VstreamX forwards any request it receives directly to the Clinic within 2 business days and informs the data subject that it has done so.

8. Security incidents

8.1 Notice to the Clinic. VstreamX notifies the Clinic within 24 hours of establishing a security incident affecting the Clinic Data (MDPA clause 9). This allows the Clinic to report it to the SIC within 15 business days of becoming aware of it, through the National Registry of Databases (RNBD) or the channel the SIC provides.

8.2 VstreamX's own duty. Under Article 18(k) of Law 1581, VstreamX has its own duty to inform the SIC. VstreamX coordinates its report with the Clinic and does not delay it. [[TO CONFIRM: VstreamX's SIC incident-reporting procedure, and whether it reports through the RNBD as a foreign Encargado]]

9. Artificial intelligence

VstreamX processes the Clinic Data in the AI features in line with the principles of SIC External Circular 002 of 2024 on the processing of personal data in artificial-intelligence systems. In particular:

• the data is processed only on the Clinic's behalf and at a User's request;
• AI output is labelled;
• a professional reviews it before relying on it; and
• the data is never used to train models (MDPA clause 4.2(c)).

10. Retention and clinical records

10.1 The Clinic's duty. The clinical record must be kept for at least 15 years from the last attention (Resolution 1995 of 1999, as amended by Resolution 839 of 2017). DentalX does not auto-delete clinical records.

10.2 At the end of the service. The complete export under MDPA clause 14 is the return of the data. It allows the Clinic to meet that duty after the deletion.

11. Registration

• The Clinic's registration. Where the Clinic must register its databases in the RNBD, it is responsible for doing so.
• VstreamX's help. VstreamX provides a summary sheet with the information on the Encargado, its Sub-processors, the destination countries and the security measures (MDPA clause 11.2).

12. The Clinic's obligations

The Clinic is responsible for:

• its Política de Tratamiento;
• obtaining the prior, express and informed authorisation of each data subject, including for sensitive data. That includes informing the data subject that answering questions about sensitive data is optional (Law 1581, Art. 6; Decree 1377, Art. 6), and DentalX provides the template; and
• handling habeas data requests.

13. Applicable law

Law 1581 and its regulations apply to the processing of the Clinic Data whatever law governs the commercial relationship under MDPA clause 23.

14. Change in law

If Law 1581 is amended or replaced (including by the bill being processed as PL 214 of 2025), VstreamX will adapt this Annex as MDPA clause 18.4 provides.

Items to confirm before publication (Colombia)

1. Publication date.
2. VstreamX's internal manual of personal-data policies for Colombia, adopted before publication (clause 5(f)).
3. VstreamX's SIC incident-reporting procedure, and the channel a foreign Encargado uses (clause 8.2).